CVE-2023-6327 MEDIUM

CVE-2023-6327: ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products

Vendor Devitemsllc
Product ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
Weakness CWE-862 · Missing authorization
Published May 9, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the past week, along with the users that purchased them.

Key dates

02Disclosure timeline

May 9, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-2083 Essential Blocks <= 4.0.6 - Missing Authorization via save CVE-2025-30855 WordPress Ads by WPQuads plugin <= 2.0.87.1 - Broken Access Control Vulnerability CVE-2024-43290 WordPress Atarim plugin <= 4.0.1 - Broken Access Control vulnerability CVE-2026-6709 Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter CVE-2024-31367 WordPress Soledad theme <= 8.4.2 - Authenticated Broken Access Control vulnerability